Category: Social Media in eDiscovery
A multi-part series on the technical and legal challenges raised by the involvement of social media sources and data in electronic discovery and how to overcome them
Social media platforms typically incorporate multiple forms of media and communication together. Facebook, for example, allows sharing of photos and videos, status updates, public posts, private messages, live chats, and more. Twitter, too, accommodates the uploading of a variety of multimedia file types, along with a combination of public posts (“tweets”) and private messages (“direct messages” or “DMs”). Moreover, this material accumulates rapidly into large volumes. Together, social media users share hundreds of millions of new posts and photos every day.
Each social media account for each individual user can contain hundreds or thousands of pages of materials in a mishmash of formats. For example, in one highly publicized case a few years ago (related to the end of the US-EU Safe Harbor program), a law student requested all of Facebook’s retained data on him and received 1,222 pages that included: posts, messages, and chat logs; log-on and posting times; records of his friends and connections; GPS data from photographs; some deleted materials, etc.
That student received those materials primarily in PDF format, but in their original formats, live on the Facebook platform, many of the files also would have carried their own metadata. For example, files on Facebook may carry metadata fields documenting their unique identifier, item type, parent item, thread, recipients, author/poster, linked media, comments, and more. Additional documentation of the available fields, including field names, can be found here. The other major platforms have comparable fields of their own in use.
Finally, beyond all of the user-created and user-shared materials, and beyond all of the metadata associated with those materials, most social media services also generate their own records of and about user activity, such as IP address logs, which can be relevant in some circumstances.
There are usually a variety of options for the acquisition of social media materials for use in litigation. The most basic is printing out the material or capturing a screen image of it. This has the advantages of being fast, simple, and cheap, but it comes with significant drawbacks.
First, you will not have captured the native file or any associated metadata, and second, unless the other party concedes the authenticity and accuracy of the print or image copy, you may have a hard time getting such a copy authenticated and admitted as evidence. But, in certain contexts (e.g., internal investigations), it may be sufficient for your needs.
One level up from printing or screen capturing content is using the self-service export tools provided by the social media platform instead. Many social media platforms, including Facebook and Twitter, offer a mechanism for a user to download an aggregated copy of the materials associated with their account. Facebook’s dates back to 2010 and is called “Download Your Information”; Twitter’s dates back to 2012 and is called “Twitter Archive.”
These kinds of features export a package of a user’s materials, which may be in a mixture of files and formats or may just be combined in a single PDF, depending on the platform and the materials in the account. This, too, is fast, simple, and cheap, but it can only be done by the account holder (or by someone with their credentials and consent). Additionally, the length and format can make the export challenging to sort through and separate once obtained.
It should also be noted, that these self-service features are designed primarily to provide users with access to their content rather than to satisfy any legal or forensic concerns. Consequently, there are limitations to what they can do that may make them unsuitable for your needs in a given case. For example, the export may not provide all available metadata and timestamps, and it won’t have any of the linked content embedded in the materials from other sites (e.g., YouTube videos).
An additional level up from the use of self-service export tools is the use of specialized forensic collection software. Just as you can forensically image a custodian’s computer using a specialized tool like EnCase or FTK, you have the option of using a similar type of software collection tool to capture the contents of a social media account. Such tools capture the files and materials, along with their metadata and any linked content, and provide options for searching, sorting, and filtering. The most commonly used tool of this type is X1 Social Discovery.
Using a tool like this carries additional costs (either for such a tool or for services from a provider with such a tool), but it can be essential for cases involving large quantities of social media materials, questions best resolved through metadata, or the potential for disputes over the authenticity and admissibility of the social media materials themselves.
Upcoming in this Series
In the next part of this series, “Legal Mechanisms for Social Media Discovery,” we will continue our discussion of how to get these materials by reviewing some of the legal mechanisms for obtaining them from other parties.
About the Author
Matthew Verga, JD
Director, Education and Content Marketing
Matthew Verga is an electronic discovery expert proficient at leveraging his legal experience as an attorney, his technical knowledge as a practitioner, and his skills as a communicator to make complex eDiscovery topics accessible to diverse audiences. A ten-year industry veteran, Matthew has worked across every phase of the EDRM and at every level from the project trenches to enterprise program design. He leverages this background to produce engaging educational content to empower practitioners at all levels with knowledge they can use to improve their projects, their careers, and their organizations.